CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlock_ovpn() unlock_ovpn() iterates over the release_list using llist_for_each_entry() and drops the peer reference inside the loop body via ovpn_peer_put(). If this drops the last reference, the peer is eventually freed. However, llist_for_each_entry() reads peer->release_entry.next in the loop advance expression, which runs after the body. By that time the peer may have already been freed, resulting in a use after free when advancing to the next list entry. Fix this by using llist_for_each_entry_safe(), which caches the next pointer before executing the loop body.
Засегнати продукти
- Linux Linux: 80747caef33d77f5c1b3d24644e6d7dae69066b5 преди 5b96227c0e8b212b74838424c929fc889aedb555; 80747caef33d77f5c1b3d24644e6d7dae69066b5 преди 4cdb209f12a89c5faf9be0c45edb90ccdf65db0c; 80747caef33d77f5c1b3d24644e6d7dae69066b5 преди e1ad6fe5db719874efa45b2caf9934552e09fc43
- Linux Linux: 6.16; преди 6.16; 6.18.42 до 6.18.*; 7.1.6 до 7.1.*; от 7.2 нататък
История
- 10 август 2026 Публикувано
Други уязвимости в Linux Linux
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-68341
- https://nvd.nist.gov/vuln/detail/CVE-2026-68341
- https://git.kernel.org/stable/c/5b96227c0e8b212b74838424c929fc889aedb555
- https://git.kernel.org/stable/c/4cdb209f12a89c5faf9be0c45edb90ccdf65db0c
- https://git.kernel.org/stable/c/e1ad6fe5db719874efa45b2caf9934552e09fc43